# DF-3966 — rt2661_rx_intr trusts the device-fed 12-bit frame length against a 2 KB cluster: up to 2047-byte OOB read into ieee80211_input

**File:** sys/dev/netif/ral/rt2661.c (pass 2; no known findings on this file;
rt2860 sibling knowns DF-3748..3753 do not cover rxeof length trust)

## What
rt2661.c:1101–1102 sets `m->m_pkthdr.len = m->m_len = (flags>>16)&0xfff`
straight from the DMA'd RX descriptor — up to 4095 — while the mbuf is a
2048-byte cluster (`m_getcl` at 1055; MCLBYTES=2048, sys/sys/param.h:497).
There is no clamp. The over-long mbuf is passed to `ieee80211_input`
(1132–1138), so up to 2047 bytes beyond the cluster are parsed as frame
content and can be delivered to the stack/userland (monitor-mode capture,
UDP payload) — a device-gated kernel heap info leak; malformed OOB header
fields can equally panic the parsers.

## Build / Run (hardware recipe)
Requires a Ralink RT2561/RT2661 NIC (guest has none — env.txt; if_ral.ko
ships in /boot/kernel). See trigger.c steps: monitor mode + one crafted
descriptor (flags[27:16] > 2048) + tcpdump capture.

## Expected
Captured frames contain bytes from beyond the mbuf cluster (kernel heap), or
a parser panic on garbage OOB bytes.